In recent years, cyber attacks, represented by malware, have been increasing. Such cyber attacks, like, for example, zero-day attacks and targeted attacks, have become shrewd and diversified, and even unknown patterns are sometimes used. For example, if an unknown pattern not registered with a security product hacks into a network, by propagating through devices in the network, the unknown pattern may spread inside the system and influence the system.
There are techniques for detecting such unknown patterns. In such a technique, for example, if the number of packets having the same protocol and data portion exceeds a threshold value, the packets are regarded as those transmitted by an unknown worm.    Patent Literature 1: Japanese Laid-open Patent Publication No. 2005-175993    Patent Literature 2: Japanese National Publication of International Patent Application No. 2008-518323.
However, by the above mentioned technique, only the spots where the unknown pattern is detected are found out and it is difficult to grasp a propagation state of the unknown pattern.